A Firewalla turns your home or small-business network into something you can actually see and control — blocking intrusions, ads and trackers, segmenting devices, and running VPNs, all with no monthly subscription. The catch is picking the right model. Here is how the lineup breaks down.
What a Firewalla actually does
Firewalla sits between your modem and your network (or alongside your existing router) and gives you enterprise-style controls in a small box: intrusion prevention, real-time traffic visibility, ad and tracker blocking, parental controls, device quarantine, network segmentation, and self-hosted VPN in and out. Unlike most security gear, there are no recurring license fees — you pay once for the hardware.
Which model is right for you?
The main difference between models is throughput (how much traffic it can inspect at once) and port speed. Match it to your internet plan and device count.
| If you have… | Look at |
|---|---|
| A typical home, gigabit-or-under internet | Firewalla Purple |
| A busy household or small office, multi-gig internet | Gold SE or Gold Plus |
| A demanding office / prosumer setup, 10G | Gold Pro |
| Wi-Fi coverage plus security in one step | Wi-Fi SD or Access Point 7 |
How to choose in three questions
- What is your internet speed? Buy a model whose inspection throughput meets or exceeds your plan, or the firewall becomes the bottleneck.
- Wired or Wi-Fi? The Gold and Purple units are firewalls you place behind or in front of a router; the Wi-Fi SD and Access Point line add Wi-Fi so you can consolidate.
- How many devices and users? More devices and heavier use point you up the Gold tiers.
A firewall is your perimeter, but ransomware and data loss usually start inside. Start with our free Cyber Risk Check, or talk to us about managed security (MSSP) that watches the whole network 24/7.
Not sure whether a Firewalla is enough on its own? A firewall is one layer. If you are protecting a business, our team can look at the whole picture — endpoints, backups, monitoring and response — not just the perimeter.
Where it sits on your network, and why that decision comes first
Most buyers choose a model before they decide how it will be deployed, and then discover the two decisions were the same decision. There are three broad ways to put a Firewalla into an existing network, and each has consequences.
Router mode replaces your existing router entirely. The Firewalla becomes the gateway: it hands out addresses, routes traffic, and sees everything by default. This is the cleanest deployment and the one that gives the most complete visibility. It also means your existing router either goes away or gets demoted to an access point, and any features you relied on it for — port forwards, dynamic DNS, guest networks — have to be rebuilt.
Bridge or transparent mode puts the unit inline between your existing router and the rest of the network without changing addressing. Nothing else needs reconfiguring, which makes it the low-friction option, but it also means you are adding a device to the chain rather than simplifying one.
Simple mode (the DHCP-takeover approach used by the plug-in units) sits on the network and takes over address assignment so traffic routes through it. It is the fastest to set up and the least invasive — and it is the mode most likely to produce surprises later, because devices with static addresses, or devices that ignore DHCP options, quietly bypass it entirely.
For a business, router mode is almost always the right answer. For a household that wants visibility this weekend without touching the ISP equipment, simple or bridge mode is a reasonable place to start, with the option to move later.
What you actually get once it is running
Visibility first. The single most valuable output is not a blocked attack — it is the device list. Almost every network we look at contains at least one thing the owner cannot identify, and a meaningful share of those are either a forgotten device, a guest’s device that never left the network, or something a former employee or contractor set up. Seeing a named list of what is connected, what it talks to, and how much it transfers is the foundation everything else rests on.
Intrusion prevention matches traffic against signature and reputation feeds and blocks known-bad destinations — command-and-control infrastructure, known malware hosts, scanners. This is real protection, and it is also the layer most likely to be misunderstood: it stops traffic to things already known to be bad, which is a large category but not an exhaustive one.
DNS-level blocking handles ads, trackers and a great deal of low-grade malvertising before a connection is ever made. It is efficient and it applies to every device on the network, including the ones that cannot run an ad blocker — smart televisions, appliances, consoles.
Segmentation is where the business case gets interesting. Putting cameras, thermostats, printers and other unpatchable devices on their own VLAN, unable to reach the machines that hold your data, removes an entire class of lateral movement. On the Gold tier this is straightforward. It is also the control most small offices never implement and most incident reports eventually mention.
VPN, both directions. The built-in VPN server gives you a way back into the office network from the road without exposing a service to the internet, and VPN client mode routes selected devices out through a provider. The first of these is the one with security value; it is a far better answer than a forwarded remote-desktop port, which remains one of the most reliable ways small organisations get compromised.
What a firewall will not do for you
Being clear about this is the difference between a useful purchase and false confidence.
It does not decrypt and inspect the contents of TLS traffic, which is nearly all traffic now. It sees destinations, volumes, patterns and reputation — not the inside of the connection. A convincing phishing page served over HTTPS from a domain registered an hour ago is not obviously distinguishable from any other new site.
It does not protect a laptop that leaves the building. The moment a device is on hotel Wi-Fi or a phone hotspot, the perimeter is behind it, which is why endpoint detection and response is a separate line item and not an optional one for a business.
It does not protect your cloud accounts. Microsoft 365 and Google Workspace are reached from anywhere; a compromised password with no multifactor authentication is a compromise that never touches your network at all. Business email compromise — still the most expensive category of loss for small organisations by a wide margin — is an identity problem, not a perimeter problem.
And it does not back anything up. Ransomware recovery is a backup question. A firewall reduces the probability of the event; tested, offline or immutable backups determine whether the event ends your week or your business.
Sizing it honestly
The number to match is not your download speed in the abstract — it is the throughput the unit sustains with inspection enabled, against the speed you actually receive, with the number of devices you actually run. A firewall whose inspected throughput sits below your internet plan becomes the bottleneck, and the usual response is to turn inspection off, which defeats the purchase.
Count devices honestly too. A modern household easily runs forty connected things once phones, laptops, televisions, speakers, cameras, thermostats, printers and consoles are included; a ten-person office with cameras and a couple of printers is in the same territory. Device count drives rule-processing load and, more practically, drives how much time you will spend in the app. Confirm current specifications on the product pages before ordering — the model line changes, and the throughput figures are the part worth reading closely.
Setup mistakes that undo the whole thing
- Double NAT. Leaving the ISP gateway doing routing as well produces a second layer of address translation that breaks inbound services and complicates diagnosis. Put the ISP device in bridge mode where the carrier allows it.
- Devices that bypass simple mode. Anything with a static IP, or anything that ignores the DHCP handoff, is outside the protection while appearing to be inside it. Verify by checking whether each device actually appears in the flow logs.
- Alerts nobody reads. Default alerting is noisy. Tune it in the first week to the handful of events you will genuinely act on, or you will learn to dismiss the notification that matters.
- No segmentation. Buying a unit capable of VLANs and then running one flat network gives up the control with the largest effect on blast radius.
- Treating it as finished. Rules, device inventory and firmware all need periodic attention. Fifteen minutes a month is enough; zero is not.
For a business, where this fits in the stack
A firewall is one layer of four that matter for a small organisation: perimeter, endpoint, identity, and recovery. Firewalla covers the first well and at a price that makes sense for an office that cannot justify enterprise hardware or the staff to run it. The other three still need answers — endpoint detection on every machine, multifactor authentication on email and remote access, and backups that someone has actually restored from in a test.
If you want to know where you stand across all four before you spend anything, the free Cyber Risk Check takes a couple of minutes and produces a list you can act on in order.